Privacy notice

Who is responsible — and for what

the operator, , is responsible for running this service. Address any data protection question to the address given in the legal notice.

Two roles have to be kept strictly apart, and that distinction is the most important sentence on this page:

• For the data of the businesses that use the service — contact details, sign-in details, billing — we are the controller.
• For the data a business records in the service about its own customers, that business is the controller. We process it on its behalf and only on its instructions. The legal basis for that is a data processing agreement between it and us.

What data is processed

When an account is created: company name, the name and email address of the person registering, country, trade, address and — where given — telephone number, tax number and website. The password is stored only as a hash that cannot be reversed.

While the service is used: everything the business records itself — enquiries, customers, jobs, quotes, invoices, costs.

Technical: access logs with IP address and timestamp, of the kind any web service produces, and a log of security-relevant events in the account (who changed which setting, and when).

Cookies and analytics

The service sets no advertising or analytics cookies and embeds no tracking pixels. Exactly two strictly necessary cookies are set: one for the sign-in session, one for the chosen language. That is why there is no cookie banner here — there would be nothing to consent to.

Who data is shared with

Only with the processors listed below, and only as far as each purpose requires. Nothing is sold, and nothing is passed on for advertising.

• Cloudflare, Inc.: Running the service: hosting, database, file storage and AI models. What is transmitted: All data stored in the service, plus technical connection data.
• Resend, Inc. bzw. MailChannels: Sending email: quotes, invoices, reminders, invitations, password links. What is transmitted: The recipient address, subject, body and attachments of that message.
• OpenStreetMap Foundation (Nominatim): Turning an address into coordinates for the job schedule. What is transmitted: The address looked up. Results are cached by us so that the same address is not looked up repeatedly.
• OpenStreetMap Foundation (Kartenkacheln) — in the browser: Drawing the job map in the dashboard. What is transmitted: The IP address and browser details of whoever opens the map.
• Anthropic PBC (optional): Language model for quote estimates and text drafts — only where an API key is configured. Without one, the AI runs on Cloudflare. What is transmitted: The text of that one request and the business’s price list. No customer lists, no invoices.
• Google (News-RSS) und Reddit: Fetching public headlines for the daily industry digest. What is transmitted: No personal data. Only public feeds are requested; nothing about a business is transmitted.

Transfers to third countries

Cloudflare, Resend and Anthropic are established in the United States. The processing relies on the European Commission’s standard contractual clauses and, where applicable, on certification under the EU-US Data Privacy Framework. For Switzerland the Swiss-US Data Privacy Framework applies in the same way.

The database behind this service runs on Cloudflare; where the data physically sits depends on the region chosen.

How long data is kept

For as long as the account exists. Where deletion of the account is requested, the data is deleted in full after a period of 30 days; the period exists so that a deletion started by mistake or in anger can be undone.

Statutory retention periods for accounting records are unaffected; they fall on the business, not on us. Before deletion, every business can export its data in full.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. To exercise them, contact the address given in the legal notice. Access to your own account data and a full export are available inside the service itself at any time.

Complaints may be addressed to the Swiss Federal Data Protection and Information Commissioner (FDPIC / EDÖB).

If your request concerns data a business has recorded about you as its customer, please contact that business. It decides about that data; without its instruction we may neither disclose nor delete it.